Hi Vinay,
please check the logon data fo the user in question (SU01 -> logon data tab). What is the user type and is there a security policy defined? If user type is dialog and there is no security policy defined, there is something wrong with the system, if the user is able to login via username/password with an expired password without being required to change his password.
Regards,
Patrick